From f9b4e4785179ee7066c673f44a600f8fa0984ed2 Mon Sep 17 00:00:00 2001 From: Thomas Darimont Date: Wed, 11 Aug 2021 17:09:13 +0200 Subject: [PATCH] KEYCLOAK-19036 Avoid infinite loop during LDAP sync with OpenLDAP and olcSizeLimit Signed-off-by: Thomas Darimont --- .../storage/ldap/idm/store/ldap/LDAPOperationManager.java | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPOperationManager.java b/federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPOperationManager.java index aa3ec28dea1..ef4015f08b1 100644 --- a/federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPOperationManager.java +++ b/federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPOperationManager.java @@ -320,6 +320,14 @@ public class LDAPOperationManager { identityQuery.getPaginationContext().setCookie(cookie); } } + } else { + /* + * This ensures that PaginationContext#hasNextPage() will return false if we don't get ResponseControls back + * from the LDAP query response. This helps to avoid an infinite loop in org.keycloak.storage.ldap.LDAPUtils.loadAllLDAPObjects + * See KEYCLOAK-19036 + */ + identityQuery.getPaginationContext().setCookie(null); + logger.warnf("Did not receive response controls for paginated query using DN [%s], filter [%s]. Did you hit a query result size limit?", baseDN, filter); } return result;